GDPR Candidate Agreement - Privacy Notice

BACKGROUND:

Excel Recruitment Limited understands that your privacy is important to you and that you care about how your personal data is used. We respect and value the privacy of all of our candidates, clients, suppliers and users of our website and will only collect and use personal data in ways that are described here, and in a way that is consistent with our obligations and your rights under the law.

Information About Us

Excel Recruitment Limited (“Excel”) is a limited company registered in Jersey under company number 59869.

Excel is an employment agency registered with The Social Security Department and it provides recruitment and work-finding services to its clients and candidates.

Excel is the data controller for any personal information you supply to us in relation to enquiries about our recruitment services and when registering as a candidate or client.

Registered address: Ground Floor, One St Andrew’s Place, Charing Cross, St Helier, Jersey, JE2 3RP.

GST number: 0005291.

Data Protection Officer:

Della Page, Operations Manager

Email address: gdpr@excel-recruitment.com.

Telephone number: (01534) 707813.

Postal address: Ground Floor, One St Andrew’s Place, Charing Cross, St Helier, Jersey, JE2 3RP.

What Does This Notice Cover?

This Privacy Information explains how we use your personal data (including sensitive personal data): how it is collected, how it is held, and how it is processed. It also explains your rights under the law relating to your personal data.

What is Personal Data?

Personal data is defined by the Data Protection (Jersey) Law 2018 (“DPJL”) (which incorporates all the applicable elements for Jersey of the General Data Protection Regulation (EU Regulation 2016/679) (the “GDPR”)) as ‘any information relating to an identifiable person who can be directly or indirectly identified in particular by reference to an identifier’.

Personal data is, in simpler terms, any information about you that enables you to be identified. Personal data covers obvious information such as your name and contact details, but it also covers less obvious information such as identification numbers, electronic location data, and other online identifiers.

The personal data that we use is set out in Part 5, below.

What Are My Rights?

Under the DPJL, you have the following rights, which we will always work to uphold:

1. 1. The right to be informed about our collection and use of your personal data. This Privacy Notice should tell you everything you need to know, but you can always contact us to find out more or to ask any questions using the details in Part 12.
  2. The right to access the personal data we hold about you. Part 11 will tell you how to do this.
  3. The right to have your personal data rectified if any of your personal data held by us is inaccurate or incomplete. Please contact us using the details in Part 12 to find out more.
  4. The right to be forgotten, i.e. the right to ask us to delete or otherwise dispose of any of your personal data that we have. Please contact us using the details in Part 12 to find out more.
  5. The right to restrict (i.e. prevent) the processing of your personal data.
  6. The right to object to us using your personal data for a particular purpose or purposes.
  7. The right to withdraw consent. This means that, if we are relying on your consent as the legal basis for using your personal data, you are free to withdraw that consent at any time.
  8. The right to data portability. This means that, if you have provided personal data to us directly, we are using it with your consent or for the performance of a contract, and that data is processed using automated means, you can ask us for a copy of that personal data to re-use with another service or business in many cases.
  9. Rights relating to automated decision-making and profiling. Part 7 explains more about how we use your personal data, including automated decision-making and profiling.

For more information about our use of your personal data or exercising your rights as outlined above, please contact us using the details provided in Part 12.

It is important that your personal data is kept accurate and up-to-date. If any of the personal data we hold about you changes, please keep us informed as long as we have that data.

Further information about your rights can also be obtained from the Jersey Office of the Information Commissioner (https://jerseyoic.org/) or the Citizens Advice Bureau.

If you have any cause for complaint about our use of your personal data, you have the right to lodge a complaint with the Jersey Office of the Information Commissioner (https://jerseyoic.org/). We would welcome the opportunity to resolve your concerns ourselves, however, so please contact us first, using the details in Part 12.

What Personal Data Do You Collect?

We may collect and hold some or all of the following personal data and special category or ‘sensitive’ personal data (this may vary according to your relationship with us):

Candidates:

So that we can identify the best possible job opportunities for you, which match your career aspirations or personal circumstances we may collect some or all of the following data:

Name;
Date of birth;
Gender;
Nationality/place of birth;
Entitlement to work in Jersey and residential status category;
Immigration status (whether you need a work permit);
Contact details, including current address, email, telephone number(s);
Employment status and history;
Notice period or availability date;
Details about your previous and current remuneration, pensions and benefits arrangements;
Educational history, qualifications and skills;
Information about your aspirations and preferences in respect of potential employment opportunities;
Marketing and communication preferences;
Health information where relevant to the type of employment you are seeking;
Photographic identification (eg. passport, driving licence or identity card);
Proof of address (eg. a copy of a utility bill or similar document);
Any additional information that you choose to share with us.

For candidates who become temporary employees of Excel, the following additional details may be collected:

Details of your bank account, tax identification number (TIN) and effective rate, and social security number;
Emergency contact details;
Referee details;
Information contained in references and employment screening and vetting checks from third parties;
Financial information (where we need to carry out financial background checks);
Details of any unspent criminal convictions, if this is required for a temporary role that you have been assigned to and, where permitted by law;

You are under no obligation to provide the Company with data. However, if you do not provide certain information, we will not be able to provide work-finding or recruitment services.

Clients:

To help us to identify candidates who are the right fit for your organisation and to ensure our working relationship runs smoothly, we may collect some or all of the following data:

Business name and contact details (including address, main telephone number and website);
Name, job title and contact details (email, direct line and mobile) of key client contacts;
Job descriptions;
Salary and benefits package;
GST/ISE status;
Any additional information that you choose to share with us.

Suppliers:

So that we can enter into a contract for your products or services with you, there is certain information that we need, including the following:

Business Name, contact details and details of products and services provided;
Names of key contacts;
Bank details;
GST/ISE status.

Please note that the above lists of personal data are not exhaustive.

How do you collect my personal data?

Your personal data is collected in a number of ways including:

Candidates:

Direct from you, for example when registering as a candidate or applying through our website. This may be via our online application form, your CV or our registration form, during the registration meeting, or when you email, text or telephone us;
Other sources may include referees and previous employers, feedback from clients, other candidates, third party employment screening providers, social media, or professional networking sites such as LinkedIn;

Automatically when you visit our website (for example your IP address, or information collected automatically using cookies, such as browser type and page last visited).

Clients:

Direct from you, for example when registering as a client; providing us with vacancy details and updates. Data may be collected when you telephone or email us or if you provide us with access to your recruitment portal or website;
Other sources may include feedback from candidates, or data that is publicly available and which will help us in better understanding your business and tailoring our recruitment services.

Suppliers:

The main way that we collect your personal data is from information provided directly by you to enable us to access your products and services and to pay you for them.

Cookies, Web Statistics and third party monitoring

For users of our website:

To improve your experience on our website, we do use functional ‘cookies’. Cookies are an industry standard and most major web sites use them. A cookie is a small text file that our site may place on your computer as a tool to remember your preferences. You may refuse the use of cookies by selecting the appropriate settings on your browser, however, please note that if you do this you may not be able to use the full functionality of this website.

Cookies can be categorised as follows:

Strictly Necessary cookies - These are cookies that allow you to use different parts of our site. Without them different features that you have requested cannot be provided. These are usually set in response to an action performed by the user like clicking on a job advert or failing to enter the correct password to their account.

Functional cookies - These help us to make your experience within our site more personal. For instance, knowing if you have been on the site before so that messages for new visitors are not displayed to you.

Session cookies - These are stored while you browse our site and then deleted once you leave.

Persistent cookies - These are saved on your computer and won’t be deleted when you close the web page. We use these to provide functionality like keeping you logged in when you come back to the site.

Performance cookies - These help us to track how people are using our site. They help us to know what pages people are using most and how users navigate around the site, we use this information to make informed decision about how we can improve the user experience of our site.

The information we get using these cookies is completely anonymous and we will make no attempt to identify you or influence your experience of our site while you are on it.

List of first party cookies:

These are cookies that are set by our website.

.ASPXAUTH (Persistent Cookie)

This is a cookie we use to authenticate a logged in user on our site, effectively this is how we keep you logged into our site and able to navigate the site without needing to login every time.

ffcookies-dismiss (Persistent Cookie)

This is used to stop the cookie policy banner popping up every time you visit our site. This cookie holds no personal data.

ff_AdDist (Persistent Cookie, Functional Cookie)

This cookie is used to identify when a user has opened the current job advert page from a link sent to them by email from us. Eg. Job Alerts or Mailshots.

ff_secCheck (Persistent Cookie)

We use this to identify each session that is open on our site. This cookie holds no personal data. All it stores is an ID number generated by us.

ASP.NET_SessionId (Session Cookie)

We use this to identify each session that is open on our site. This cookie holds no personal data. All it stores is an ID number generated by us.

ffIEWarning (Session Cookie)

We use this cookie to notify a user that they are using an outdated version of IE and that they should upgrade. This cookie holds no personal data.

__AngularAntiXsrfToken (Session Cookie)

This cookie is used to ensure the person performing an action is currently browsing our website preventing cross site request forgery attacks. This cookie holds no personal data and only stores a random ID that persists for the length of the session.

__AntiXsrfToken (Session Cookie)

This is an additional cookie that is used to ensure the person performing an action is currently browsing a Firefish site preventing cross site request forgery attacks. This cookie holds no personal data and only stores a random ID that persists for the length of the session.

List of third party cookies:

These are the cookies that are set by other websites through embedded content:

Intercom (Functional cookies)

Intercom is used for customer support and notification. For detailed cookie information see: https://www.intercom.com/help/en/articles/2361922-intercom-messenger-cookies

AddThis (Functional cookies)

AddThis sets up sharing options to allow visitors to share pages with other websites such as social media. For detailed cookie information see; https://www.addthis.com/privacy/privacy-policy

LinkedIn (Functional cookies)

These are used to allow visitors to post links directly into LinkedIn when visiting the site and are set after interacting with the sharing functionality. For detailed cookie information see: https://www.linkedin.com/legal/l/cookie-table#thirdparty

Meta (Functional cookies)

These are used to allow visitors to post links directly into Facebook when visiting the site and are set after interacting with the sharing functionality. For more information on how Meta use cookies see: https://www.facebook.com/policies/cookies

Twitter (Functional cookies)

These cookies are used to allow visitors to post links directly to Twitter when visiting the site and are set after interacting with the sharing functionality. For more information on how Twitter use cookies see:https://help.twitter.com/en/rules-and-policies/twitter-cookies

HubSpot (Performance cookies)

Hubspot is used as a CRM and to help understand how visitors use our website. For detailed cookie information see: https://knowledge.hubspot.com/reports/what-cookies-does-hubspot-set-in-a-visitor-s-browser

Google Analytics (Performance cookies)

We use google analytics to help us understand how visitors use our website. For detailed cookie information see: https://business.safety.google/adscookies/

How Do You Use My Personal Data?

The Company needs to collect and process data in order to offer work-finding and recruitment services to you.

Under the DPJL, we must always have a lawful basis for using personal data. This may be because the data is necessary for our performance of a contract with you, because you have consented to our use of your personal data, to comply with regulatory or statutory legal obligations, or because it is in our legitimate business interests to use it.

A legitimate interest is where we have a business or commercial reason to use your information in conducting and managing our business. We will take into consideration and balance any potential impact on you and your legal rights when we process your personal information for our legitimate interests. We do not use your personal information for activities where our interests are overridden by the impact on you (unless we have your consent or are otherwise required by law to comply with a legal or regulatory obligation, or are permitted to by law).

Our legitimate interests are to provide work-finding and recruitment services to our candidates and clients by matching suitably qualified and experienced candidates to clients’ vacancies and businesses. As a candidate by submitting your personal information and CV and actively engaging with us in your job search, we believe it is reasonable to expect you are happy for us to collect and use your information in order to provide our work-finding and recruitment services to you, to assess your suitability for roles and to share that information with potential employers. As a client by engaging with us to source suitable candidates for your business we believe it is reasonable to use your information to help us manage this process.

Your personal data may be used for one of the following purposes:

Purpose	Lawful basis for processing
Supplying our work finding and recruitment services to you. Your personal details are required in order for us to enter into a contract with you and it is in our legitimate interests to ensure that our relationship can run smoothly;	Performance of a contract Legitimate interests
Personalising and tailoring our recruitment services for you;	Legitimate interests
Communicating with you. This may include responding to emails or calls from you;	Legitimate interests
Internal record keeping;	Legitimate interests
If you are a candidate, to assess information about you against vacancies which we believe may be suitable for you;	Legitimate interests
If you are a candidate, to contact you via email, text or telephone about vacancies that we believe you may be interested in;	Legitimate interests
If you are a candidate, to send your information to clients for potential jobs or to assess suitability for the role. We will obtain your consent before providing your details to a client unless we have specifically agreed otherwise with you;	Legitimate interests Consent
To pay you (including processing any statutory deductions and regulatory reporting) where you have been placed on assignment as a temporary employee with one of our clients;	Performance of a contract Legal obligations
To carry out employment screening and vetting checks where you have been placed in employment or in a temporary assignment with one of our clients;	Legitimate interests Consent Performance of a contract
If you are a client we will use the information you provide to us about your company or vacancies to match against suitable candidates;	Performance of a contract Legitimate interests
From time to time, we may also use your information to contact you for market research purposes or to carry out a customer satisfaction survey. We may contact you by email, phone or mail.	Legitimate interests You have the right to unsubscribe from mailings or to update your marketing preferences and this will be noted in all marketing communications
To contact you by email with information, news, and job updates;	Legitimate interests You have the right to unsubscribe from mailings or to update your marketing preferences and this will be noted in all marketing communications
Where you are a supplier, we will use the information you provide to ensure our relationship runs smoothly and so that we can pay you for your products or services.	Performance of a contract Legitimate interests

Our recruitment decisions are not based solely on automated decision-making or profiling. We may use the search facility within our client relationship database to help us identify potential candidates who may have the skills and experience for a specific role.

How Long Will You Keep My Personal Data?

We will not keep your personal data for any longer than is necessary in light of the reason(s) for which it was first collected. Your personal data will therefore be kept for the following periods (or, where there is no fixed period, the following factors will be used to determine how long it is kept):

If we have not had any meaningful contact with you for a period of 3 years (or, in the case of Client Contacts, the hiring client you are working for or with), we will delete your personal data from our systems. This will apply unless we believe that the law or other regulation requires us to preserve it (for example, because of our obligations to local authorities or in connection with any anticipated litigation). After this period it is unlikely that your data will be relevant for the purpose for which it was collected.
When we refer to "meaningful contact", we mean, for example, communication between us (either verbal or written). If you are a Candidate we will consider there to be meaningful contact with you if you submit your updated CV, communicate with us about potential roles, either by verbal or written communication or click through from any of our marketing communications.
If you are a Client Contact working for or with a hiring client, when we refer to “meaningful contact”, we mean for example, communication between us (either verbal or written), or where you are actively engaging with us and using our services. We will consider there to be meaningful contact if you communicate with us about potential services, either by verbal or written communication.
If you are a current or previous temporary employee of Excel Recruitment we will only hold your personal data for as long as is necessary to fulfil the purposes we collected it for, including any legal, accounting or reporting requirements. The periods for which your data is held after the end of employment are 6 years after employment ceases for personnel file (soft and/or hard copy) and 10 years for payroll records (to comply with our obligations under Employment (Jersey) Law 2003).

How and Where Do You Store or Transfer My Personal Data?

Your personal data is primarily stored on your candidate or client record within our recruitment CRM software, which is hosted in the cloud (in partnership with Microsoft Azure). By partnering with Microsoft Azure, our CRM software provider is able to deliver an ultra secure cloud-based solution, which meets a broad set of international and industry specific compliance standards such as ISO 27001 (the international standard for Information Management Security Systems), HIPAA, FedRAMP, Soc 1 and Soc 2 as well as country-specific standards such as UK G-Cloud, Australia IRAP and Singapore MTCS.

Our CRM service provider employs enterprise-class security features with comprehensive annual audits of their applications, systems, and networks to ensure all customer data is fully protected. They are also compliant with the requirements of the Cyber Essentials Scheme and have been accredited with their certificate of assurance in relation to Data Security.

The Company’s email system is also cloud based with robust security and encryption.

For systems that are not currently cloud based (i.e. payroll software), the data is stored on a private server located within our offices and accessed only by authorised personnel of Excel Recruitment and our IT support provider; it is protected by physical and software firewalls and anti-virus and anti-malware software. Encrypted backups, using bank grade encryption (which ensures that data is secure in transit and at rest), are replicated to our out-sourced IT support provider’s datacentre (located in the UK).

In providing our recruitment and work finding services your personal data may be transferred to countries outside the European Economic Area (‘EEA’), for example where you are submitted for a position with a prospective employer in Jersey, who may in turn transfer your data to personnel in one of their offices that is based outside the EEA. In respect of trusted third party suppliers, your personal data may be stored on cloud based systems which are located outside of the EEA.

These countries may not have data protection laws that are as robust as those within the UK/Jersey or EEA. This means that we will take additional steps in order to ensure that your personal data is treated just as safely and securely as it would be under the DPJL.

The security of your personal data is essential to us, and we will take all reasonable steps to ensure that it is protected from misuse, loss or unauthorised access in line with appropriate technical and data security practices.

Do You Share My Personal Data?

Candidates

In order to assist you in your work finding search, we may share your personal data with the following categories of people/organisations, including but not limited to:

Prospective employers, who may share your data internally or internationally. In doing so your data will also be subject to their Privacy Policy;
Current, past or prospective employers, educational establishments and professional bodies in respect of information required for employment screening and vetting purposes;
Trusted third party suppliers whose services we use to carry out vetting checks such as criminal record checks and credit checks and with whom we have a processing agreement (or similar protection) in place. Such checks are only carried out with your explicit consent and in accordance with applicable laws;
Trusted third party suppliers such as professional advisors or those who we have engaged to provide IT support, and software solutions such as our client relationship database, payroll system and marketing platform; with all of whom we have a processing agreement (or similar protection) in place;
Regulatory or statutory body in respect of legal proceedings or complying with legal obligations, a court order, or the instructions of a government authority.

Clients:

In order to provide you with the best possible recruitment service, we may share your information within our business, with prospective candidates, and with associated service providers.

Suppliers:

To enable our relationship to run efficiently we will share your information within our business, and with associated service providers.

If any of your personal data is required by a third party, as described above, we will take steps to ensure that your personal data is handled safely, securely, and in accordance with your rights, our obligations, and the third party’s obligations under the law, as described above in Part 9.

If any personal data is transferred outside of the EEA, we will take suitable steps in order to ensure that your personal data is treated just as safely and securely as it would be within the UK and under the DPJL, as explained above in Part 9.

How Can I Access My Personal Data?

If you want to know what personal data we have about you, you can ask us for details of that personal data and for a copy of it (where any such personal data is held). This is known as a “subject access request”.

All subject access requests should be made in writing and sent to the email or postal addresses shown in Part 12. To make this as easy as possible for you, a Subject Access Request Form is available for you to use. You do not have to use this form, but it is the easiest way to tell us everything we need to know to respond to your request as quickly as possible.

There is not normally any charge for a subject access request. If your request is ‘manifestly unfounded or excessive’ (for example, if you make repetitive requests) a fee may be charged to cover our administrative costs in responding.

We will respond to your subject access request within one month of receiving it. Normally, we aim to provide a complete response, including a copy of your personal data within that time. In some cases, however, particularly if your request is more complex, more time may be required up to a maximum of three months from the date we receive your request. You will be kept fully informed of our progress.

How Do I Contact You?

To contact us about anything to do with your personal data and data protection, including to make a subject access request, please use the following details (for the attention of Della Page, Operations Manager):

Email address: gdpr@excel-recruitment.com.

Telephone number: 01534 707800.

Postal Address: Ground Floor, One St Andrew’s Place, Charing Cross, St Helier, Jersey, JE2 3RP.

Changes to this Privacy Notice

We may change this Privacy Notice from time to time. This may be necessary, for example, if the law changes, or if we change our business in a way that affects personal data protection.

Any changes will be made available on our website and a copy can be provided on request (by email or post).